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The Universal Blind Quantum Computation (UBQC) protocol Q] allows a client to perform 
quantum computation on a remote server. In an ideal setting, perfect privacy is guaranteed if the 
client is capable of producing specific, randomly chosen single qubit states. While from a theoretical 
point of view, this may constitute the lowest possible quantum requirement, from a pragmatic point 
of view, generation of such states to be sent along long distances can never be achieved perfectly. 

We introduce the concept of e-blindness for UBQC, in analogy to the concept of e-security de- 
veloped for other cryptographic protocols, allowing us to characterize the robustness and security 
properties of the protocol under possible imperfections. We also present a remote blind single qubit 
preparation protocol with weak coherent pulses for the client to prepare, in a delegated fashion, 
quantum states arbitrarily close to perfect random single qubit states. This allows us to efficiently 
achieve e-blind UBQC for any e > 0, even if the channel between the client and the server is 
arbitrarily lossy. 
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While modern advances in quantum information are 
making strides towards scalable quantum computers, the 
dream of small and privately owned quantum computers 
remains very distant. Realistically, large quantum servers 
may in the near future take a role similar to that occupied 
by massive superclusters today. They will be remotely ac- 
cessed by a large number of clients, using their home-based 
simple devices, to solve tasks which seem difficult for clas- 
sical computers, while enjoying full privacy guaranteed by 
an efficient cryptographic scheme. 

A similar question has been also addressed in the con- 
text of classical client-server scenarios. Considering un- 
conditional security, Abadi, Feigenbaum and Killian stud- 
ied the notion of "computing with encrypted data", and 
showed that no N P-hard function can be computed blindly 
if unconditional security is required, unless the polynomial 
hierarchy collapses at the third level [2]. A related ques- 
tion which offers privacy with computational assumptions, 
known as fully homomorphic encryption, remained open 
for 30 years [3]. 

Various protocols have been devised with the goal of re- 
alizing such delegated, yet private and secure, quantum 
computing [TJ 0H7J- These protocols vary upon their re- 
quirements for the client and the achievable level of secu- 
rity. Among them, the universal blind quantum computing 
(UBQC) proposed by Broadbent, Fitzsimons and Kashefi 
PQ stands as the optimal one, with the lowest requirements 
on the client: in particular, no quantum memory is needed. 
The security offered by the ideal UBQC protocol is uncon- 
ditional: the server cannot learn anything about the client 
computation, input or output. This flavour of security is 
called blindness. The feasibility of UBQC using different 
physical resources has been addressed [7J [5] and the poten- 
tial of UBQC already prompted experimental demonstra- 
tions on a small scale [9]. 

The only 'non-classical' requirement for the client in the 
ideal UBQC is that she can prepare single qubits in the 
state \+ B ) = i(|0) + e i9 |l}) with 6 e {0, tt/4, . . . , 7tt/4}. 



The blindness of the UBQC protocol has only been es- 
tablished in the ideal case where the client prepares per- 
fect qubits. In any physical implementation, however, the 
preparation will inevitably be imperfect and this has to 
be taken into account before making any statement about 
security. For instance, the qubits could be encoded in 
the polarization of a single photon generated by a real- 
istic single photon source. Then completely suppressing 
the probability of inadvertently sending two or more iden- 
tically polarized photons instead of one is very difficult, 
yet such an event would invalidate the perfect privacy of 
the client. While the future may bring scalable and fault- 
tolerant quantum computation required for the server, per- 
fect quantum devices required to guarantee the perfect se- 
curity for the client are unlikely to ever be achieved in 
practice. 

The main contribution of this paper is towards this di- 
rection: we investigate the security of UBQC with realistic 
imperfections for the client. For this purpose, we intro- 
duce the framework of approximate blindness [e-blindness) 
where the (small) parameter e quantifies the maximal prob- 
ability of successfully distinguishing between the actual 
protocol and the ideal one introduced in [I]. A similar 
approach to defining approximate security has been a mile- 
stone in the context of cryptography, and recently extended 
to the case of quantum key distribution (QKD) [TU1 fTTI l?7] 
and other quantum cryptographic primitives in the, so- 
called, bounded storage and noisy storage models P~2l414J . 

We will show that the level of security is indeed higher 
when the states prepared by the client are closer to the 
ideal qubits. We then introduce a protocol allowing the 
client to prepare the qubits in a delegated fashion at the 
server's location. The client needs to encode the quantum 
information into the polarization of weak coherent pulses 
which are sent to the server through an arbitrarily lossy 
quantum channel. Therefore, the burden of preparing very 
good qubits is put on the server, who needs in particular to 
be able to perform non-demolition quantum measurements 
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[T5] . We will show that these realistic requirements (for the 
client) are compatible with e-blind UBQC, where e can be 
made arbitrarily small. This approach shares striking simi- 
larities with the history of QKD where the initial protocols 
required true single photons but later became compatible 
with the much more practical weak coherent pulses. 

We begin with a brief recap of the UBQC protocol. 

Universal Blind Quantum Computation. — The UBQC 
protocol is set in the framework of measurement-based 
quantum computation (MBQC) [TBHT5] . In MBQC the un- 
derlying resource is a multipartite entangled quantum state 
and the computation is executed by performing measure- 
ments on its subsystems. In particular, this resource state 
can be a generic brickwork state, a close relative of the clus- 
ter state (see the Appendix section B for details). By ap- 
plying single qubit measurements parametrized by a mea- 
surement angle from the discrete set {0, 7r/4, . . . , 77r/4}, 
which collapse the measured qubit state to one of the two 
eigenstates {|±^) = ^(|0) ± e l< ^|l))}, with corresponding 
eigenvalues ±1, one can achieve universal quantum compu- 
tation pQ. Here, the computation itself is encoded in the 
measurement angles alone and the underlying resource is 
generic. 

The classical and quantum part of MBQC can be con- 
ceptually separated. One can imagine a classical controller 
which generates the measurement angles and a quantum 
unit which prepares the resource state, performs the mea- 
surements (as dictated by the controller unit), and returns 
the measurement outcomes to the controller unit. The out- 
comes are crucial for the adaptive structure of MBQC: since 
they are probabilistic, the subsequent measurement angles 
must depend on them to ensure deterministic computation 
PI [20]. 

The central idea behind UBQC is to use this separation 
and allocate the classical controller unit to the client and 
the quantum unit to the server. To ensure privacy, how- 
ever, the computation needs to be encoded: this is achieved 
in UBQC by effectively encoding the resource state. 

The standard procedure for MBQC, to prepare the re- 
source state, is to start with a set of qubits in a fixed state, 
say |+) := |+o), and to apply an entangling operation of 
the Controlled Phase gate (ctrl-Z) to some of them. 

In UBQC, by contrast, the client will provide the initial 
phase rotated qubits of the form \+ g ) to the server, with- 
out informing him of the values of 9 G {0, tt/4, . . . , 7ir/4}. 
Applying the entangling gates then prepares an encoded 
resource state. Now, if one was to measure a qubit in 
the usual MBQC protocol with some measurement angle 
4>, this would be equivalent to measuring the pre-rotated 
qubit (in the state \+g) with the angle 5' = <p + 9 mod 27r, 
as the phase rotation and ctv\-Z gate commute. In this 
case, the measurement angle alone says nothing about the 
computation run, but a malicious server may still try learn 
something about 9 when given 5', hence also about 4> (*- e - 
about the computation). 

To solve this security loophole, UBQC exploits the prob- 
abilistic nature of MBQC. The client sends a modified mea- 
surement angle S = (fi + O + m mod 2tt, where r S {0, 1} is 
chosen randomly by the client and hidden from the server. 
The value of r can be interpreted as a flip of the measure- 
ment outcome, which can be easily compensated by the 



client. 

Now the quantum information (pre-rotated qubits) and 
classical information (measurement angles) accessible to 
the server is no longer correlated to the client's desired 
computational angles (denoted <p) , and this constitutes the 
crux of the proof of blindness of UBQC pQ. 

One can summarize the UBQC protocol as follows: Ini- 
tially, in the preparation phase, the client sends S (the size 
of the computation) randomly pre-rotated qubits in the 
states {l+fli)}^!, to the server, keeping the angles 9i se- 
cret. The server then builds up the brickwork state using 
the received qubits and the ctrl-Z interaction. Proceed- 
ing sequentially on each qubit, if the desired measurement 
angle for qubit i was 4n (defined for the non-prerotated 
resource state, and including the necessary adaptations to 
the angle based on prior measurement outcomes Sk<i), the 
client will ask the server to measure the qubit with respect 
to the angle Si = <f>i + 9% + r^ mod 27r, where the binary 
parameter r, is chosen randomly. The server reports each 
measurement outcome s$ which the client flips if r; = 1. 

In the case of an honest server, this procedure yields the 
correct outcome of the computation. Moreover, regardless 
of the malicious activity of the server the client's privacy 
is unconditional - the protocol is blind (see the Appendix 
section B for details). 

This blindness, however, only holds if the client can pre- 
pare the needed qubits perfectly. In a practical implemen- 
tation, imperfection is inevitable and perfect blindness can- 
not be achieved. For this reason, a notion of approximate 
blindness is required. 

Approximate blindness. — A difficulty to characterize the 
UBQC protocol is that it is adaptive. However, as far as 
blindness is concerned, the reported outcomes Sj of the 
server do not matter; they only affect the correctness of 
the protocol [28]. Hence one can assume Sj = (i.e. the 
server measurement always projects into the +1 eigenvalue, 
similar to a post-selection scenario) , and since the random 
parameters fj can be chosen in advance, the need for the 
adaptive structure can be ignored. Therefore, blindness 
can be studied through the following joint state of the client 
and server: 

*ab 1 = ^ £ <8> rn^f^H ® l+*x+g,i®iw[ . 

~f t -?%€[S\ Client (A) Server (B) 

which contains all the relevant information pertaining to 
the security of a run of a UBQC protocol as seen by the 
server. The client has also access to the angles 9i. How- 
ever, these angles do not constitute the secret the client 
wishes to hide - for blindness only the r, parameters and 
the (adapted) computation angles are relevant. Thus in 
the presented joint state we explicitly place the client's se- 
cret in the client's register, and all information accessible to 
the server in the server's register. In this classical-quantum 
(cq) state, S denotes the overall size of the computation. 
The client's register contains the user's secret classical in- 
formation - the computational angles 4>i characterizing the 
desired computation, and the ri parameters chosen ran- 
domly and unknown to the server. The server's register 
contains quantum information - the qubits in states 1+^) 
which are sent by the client, as well as the measurement 
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angles <5,; . Note that <pi , ri and Si are all represented by 
classical, orthogonal states. 

If the information shared by the client and the server can 
be described by the state tt ab &1 , then a malicious server 
cannot learn anything about the computation of the client 
PP. Since the security holds for any action of the server, 
any UBQC protocol described by a state of the form 

(1 A ®£)7T^ 1 (1) 

for any completely positive trace preserving map £ (rep- 
resenting any possible deviation from the protocol by the 
server) is equally blind. We refer to such states as uncondi- 
tionally blind states and define the family T of such states 
as follows: 

T = {(l A <E>£)ir% al \£ isaCPTPmap}. (2) 

In order to analyse the impact of imperfections caused by 
a realistic implementation, we consider the settings where 
the client sends general states p 6i instead of the perfect 
states 1+6;). In this case, the joint state representing all 
the information exchanged in the protocol is given by: 

*ab } = ^E <8> l&mflnXnl ® ^®^)^ . (3) 

~£^t£[S] Client Server 

We can now introduce the notion of e-blindness: 

Definition 1. A UBQC protocol with imperfect client 

preparation described by the shared joint state tt a p b * s e ~ 
blind if the trace distance between the family of uncondi- 
tionally blind states and the state ir AB is less than e: 

mm hn { A i i} --K £ AB \\<e (4) 

"Sb6^ 2 

Such a notion of security is particularly desirable as it 
is composable QTJ [2"Trt23| . One can also extend it to a 
more general setting considering prior knowledge about the 
computation (see the Appendix, section C). 

If the states p 0i generated by the client are uncorrelated 
(which holds for instance if the process determining the 
parameters Oi is random and memoryless), the distance 
between the perfectly blind state and the approximate state 

Tab ^ can b e bounded in terms of the distance between the 
individual states pr* and the corresponding perfect qubit 
states \+6i)- In particular, defining 

e prcp = max -f(|+ e J(+ 0i |)|| (5) 

for some CPTP map £ independent of all 6i, then one can 
show (see the Appendix, section C) that 

min l\\n { A p B } -ir AB \\<Se plcp . (6) 

This means that the ability to prepare good approxima- 
tions of the states |+e ; ) translates into the ability to per- 
form approximately-blind universal quantum computing. 

This, however, is not completely satisfying from the 
client's perspective. Indeed, the client can only achieve 
a given value of e pre p in practice, meaning that for a fixed 



security parameter e, she cannot perform a computation 
with more that e/e pre p steps. In order to allow for compu- 
tation of arbitrary size, it is necessary to prepare arbitrary 
good qubits and the solution is to delegate this task to the 
server, who is assumed to be much more powerful than the 
client. 

We proceed by presenting such a Remote Blind qubit 
State Preparation (RBSP) protocol where the client only 
needs to prepare weak coherent pulses with a given po- 
larization. The requirements for the client are therefore 
minimal. In particular, they are the same as in most prac- 
tical implementations of discrete- variable QKD. The diffi- 
culty here is transferred to the server who has to perform 
a quantum non-demolition measurement to obtain the de- 
sired qubit. As we will show, using the RBSP protocol 

f„0i\ 

S times, the client can reach a joint state tt ab which is 
e-close to the family T of perfectly blind states. 

UBQC with Remote Blind qubit State Preparation using 
weak coherent pulses. — The RBSP protocol is designed to 
serve as a substitute for the process of sending one individ- 
ual perfect random qubit which allows for imperfect devices 
and channel. 

Ideally, its outcome will satisfy the following properties: 
(A) the state in the server's possession is £(\+e)(+g\) for a 
CPTP map £ , independent of 8 known to the client alone - 
guaranteeing perfect blindness, see Eq. ([5]); (B) the proto- 
col is never aborted in the honest server scenario - guaran- 
teeing robustness of the encompassing UBQC; (C) in the 
honest server scenario, the map £ is the identity - guaran- 
teeing the correctness of the UBQC protocol. 

When imperfections are taken into account, the UBQC 
using RBSP in the preparation phase approaches the prop- 
erties of blindness and robustness asymptotically. Hence, 
we are interested in the following properties: e-blindness, 
as described above, and e-robustness which guarantees that 
the honest abort probability is less than e. Despite the im- 
perfect preparation stage, we also show that the correctness 
of the protocol holds in the honest scenario, whenever the 
client does not abort. 

To run the RBSP protocol, the client sends a se- 
quence of N weak coherent pulses (small amplitude, phase- 
randomized coherent states) with random polarization a 
in the set {0, 7r/4, . . . , 7tt/A} to the server. If the trans- 
mittance of the channel from the client to the server is 
supposed to be at least T, then the mean photon number 
of the source is set to /i = T. This value of fi = T is 
optimal for our security analysis, however other values are 
in principle admissible as well. The introduced phase ran- 
domization simplifies the security analysis and causes the 
state emitted from the source to be: 

oo 

where Ifc)^ := |+ cr )®' c corresponds to k photons, occur- 
ring with probability pk = e~ T T k /kl, with polarization a. 
Each pulse is then a probabilistic mixture of Fock states. 
The Poissonian distribution obtained here is not crucial for 
the RBSP protocol. For instance, it would work equally 
well (with re-adjustment of parameters) with any source 
realizing a mixture of polarization encoded photon num- 
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ber states, such as polarized thermal states, provided that 
the probability of getting a single photon is not too small. 

The server then performs non-demolition photon number 
measurements on the pulses he receives, declaring the num- 
ber outcomes to the client. This additional requirement on 
the quantum server, while a challenging task has already 
been experimentally implemented |24j . At this point, the 
client checks the number of reported vacuum states - if 
this number is greater than N(e~ T + T 2 /6), she aborts 
the protocol. A higher value would be indicative to either 
a lossier than believed channel, or more importantly, that 
the server lied in an attempt to cheat. 

If the protocol was not aborted, the server performs the 
interlaced ID cluster computation subroutine (I1DC), us- 
ing the photons obtained by the number measurement of 
the received coherent pulses. In this subroutine, the server 
couples the first and the second qubit (i.e. photons) with 
the interaction cti\-Z.(H(g>l), and the first qubit of the pair 
is then measured in the Pauli X basis and the measurement 
outcome is sent to the client. The remaining qubit is then 
coupled to the third qubit in the input set and measured 
in the same basis. This process is repeated until only one 
qubit remains unmeasured, in some state |+e). 

Using her knowledge about the polarizations of each of 
the pulses initially sent, and the reported binary string of 
outcomes, the client can compute the angle 9 (see the Ap- 
pendix section D for details). The pair 9 (held by the 
client) and \+g) (held by the server), is the required out- 
come of the RBSP protocol. 

The intuition behind this protocol is the following. The 
I1DC subroutine is such that if the server is totally igno- 
rant about the polarization of at least one photon in the ID 
cluster, then he is also totally ignorant about the final angle 
9. In order to exploit this property, the client should make 
sure that the server will at least once measure a single pho- 
ton and put it in the cluster. The cheating strategy for the 
server consists in claiming he received photon when he 
received 1 and claiming he received 1 when he in fact mea- 
sured several (in which case he can learn something about 
their polarization) . In order to avoid this attack, the client 
simply verifies that the reported statistics of the server are 
compatible with the assumed transmittance of the channel. 
Note that the server cannot learn anything useful, even if 
he deviates from the prescribed I1DC subroutine if one of 
the weak coherent pulses generated one photon, and was 
declared as such. We now give more quantitative state- 
ments which are proven in the Appendix (together with 
detailed descriptions of both RBSP and I1DC). 

For the described RBSP protocol, property (A) holds ex- 
cept with probability ptaii and properties (B) and (C) hold 
except with probability p a bort- These probabilities p a bort 
and pf a ii can be bounded as functions of the transmittance 
T and the parameter N as follows: 



Pfail, Pabort < exp 



NT 4 



(7) 



Using the bound on Pf a a, the trace distance between the 
perfectly blind qubit state and the state pg generated by 
RBSP can be bounded as 



for a fixed CPTP map E independent of 9. From this, 
by the criterion given in expression ([6]), the bound given 
in Eq. ([7]) and the union bound, we have that a pro- 
tocol using the RBSP generated states is e-blind with 
e < S exp (-7VT 4 /18) , where T is a lower bound on the 
channel transmittance, and N the number of states used 
in each instance of RBSP. These results are proven in de- 
tails in the Appendix and collected in the following main 
theorem: 

Theorem 1. A UBQC protocol of computation size S, 
where the client 's preparation phase is replaced with S calls 
to the coherent state Remote Blind qubit State preparation 
protocol, with a lossy channel connecting the client and the 
server of transmittance no less than T, is correct, e-robust 
and e-blind for a chosen e > if the parameter N of each 
instance of the Remote Blind qubit State preparation pro- 
tocol called is chosen as follows: 
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We acknowledge that the RBSP protocol is not immune 
to noise in the channel or to significant preparation errors 
on the side of the client. A method of performing RBSP 
in a fault tolerant way, by adapting techniques used to 
ensure the fault tolerance of UBQC itself [1 , 8, 26 , is under 
the investigation of the authors. However, noise can only 
jeopardize the correctness of our protocol, but never the 
guaranteed security levels. 

Conclusions and outlook. — In this work we have ad- 
dressed the security of UBQC under the presence of im- 
perfections through the concept of e-blindness. Following 
this we have given a Remote qubit State Preparation pre- 
protocol which allows a client, with access to weak coherent 
pulses only, to enjoy UBQC with arbitrary levels of secu- 
rity. 

The transition from the idealized setting of UBQC using 
single photon qubits to the present protocol using weak 
coherent pulses brings UBQC significantly closer to real-life 
applications for, e.g. an unconditionally secure quantum 
network. The parallel with the evolution of QKD is also 
very interesting. Note that in QKD, weak coherent pulses 
were not very attractive for long distance communication 
before the invention of protocols with decoy states [2"5] . 
Indeed, these decoy states made the optimal intensity p, 
of the attenuated laser be roughly a constant, in contrast 
with the optimal p w T without decoy states. In the case 
of UBQC, it might also be the case that decoy states could 
improve the optimal value of p and therefore significantly 
decrease the required number weak coherent pulses used in 
an instance of RBSP for a given computation. 
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Appendix 

A Outline 

In section B , we give a detailed description of the UBQC protocol, the definition of blindness and the statement of 
the main theorem guaranteeing blindness of UBQC from pQ. Section C gives the definitions of e-blindness in presence of 
prior knowledge about the computation and the derivation of the expression (6) from the main paper. This expression 
links the trace distance between ideal prepared qubits and imperfectly prepared states with the blindness parameter e 
of the encompassing UBQC which uses these imperfect states. In Section D , we give a detailed description of the I1DC 
subroutine, with the proof of its correctness, and in Section E , we present the details of the entire Remote Blind State 
Preparation (RBSP) protocol. We prove the security characteristics of RBSP claimed in the main paper. Finally, in 
the last section, we derive the characterization of the states generated be RBSP in terms of the criterion given by the 
expression (5) from the main paper, which is the crux of our main security theorem for UBQC with weak coherent pulses. 

B Universal Blind Quantum Computation 

For the detailed overview of the UBQC protocol, we will assume the familiarity with the measurement-based quantum 
computing, for more details see |16l ? ]. Suppose the client has in mind a unitary operator U that is implemented with a 
measurement pattern on a brickwork state Q n xm (Figure [l]) with measurements given as multiples of 7r/4 in the (X, Y) 
plane with overall computation size S = n x m. This pattern could have been designed either directly in MBQC or from 
a circuit construction. Each qubit \ip x , y ) € Gnxm is indexed by a column x G {1, . . . , n} and a row y € {1, . . . , m}. Thus 
each qubit is assigned a measurement angle 4> x . y , a set of X-dependencies D x y C [x — 1] x [m] and a set of ^-dependencies 
D XiV C [x — 1] x [m] . Here, we assume that the dependency sets X x , y and Z x ^ y are obtained via the flow construction [TS]. 

During the execution of the pattern, the actual measurement angle <f>' xy is computed from tfi XiV and the previous 
measurement outcomes in the following way: let s^ y — ®ie d x v Si be the parity of all measurement outcomes for qubits 
in X x ,y and similarly, s% y = (BieD'^ y Si be the parity of all measurement outcomes for qubits in Z x<y . 

Then 4>' Xty = {-l)''"<f> XlV + sf iW 7r . 

Protocol [T] implements a blind quantum computation for U. 

We assume that the client's input and output of the computation are built into U. In other words, the client wishes 
to compute the results of some fixed single qubit measurements in the (X, Y) plane of the state U(\+) . . . |+)). Note 
however, that the protocol could be easily extended to deal with arbitrary classical or quantum input and output pQ. 



Protocol 1 Universal Blind Quantum Computation 

1. Client's preparation 

For each column x = 1, . . . , n, 
for each row y — 1, . . . , m, 

1.1 the client prepares the state \ip x , y ) G : = Tfd ) + e^"! 1 )) I Ox,y = 0,7r/4, . . . ,7tv/4}, where the defining angle 

9 x ,y is chosen uniformly at random, and sends the qubits to the server. 

2. Server's preparation 

2.1 The server creates an entangled state from all received qubits, according to their indices, by applying CTRL-i? operators 
between the qubits in order to create a brickwork state C/ nxm . 

3. Interaction and measurement 

For each column x = 1, . . . , n 
For each row y — 1 , . . . , m 

3.1 The client computes <f) XiV where s 0iB — s o,y = 0. 

3.2 The client chooses a binary digit r x , y 6 {0, 1} uniformly at random, and computes 5 XtV — (f>' x _ y + 8 XtV + irr x ,y 

3.3 The client transmits 8 x ,y to the server, who performs a measurement in the basis {|+i x „), |— b x „)}. 

3.4 The server transmits the result s WtV £ {0, 1} to the client. 

3.5 If r x , y = 1, the client flips s x ,y', otherwise she does nothing. 



In the main text and in this Appendix, for simplicity, we have used single indexing for all the involved parameters: the 
measurements angles (f>i, the random variables and 9i, the messages to the server Si (characterising the measurement 
angles to be performed) and the server's messages to the client Sj (measurement outcomes). In particular, one has 
Si = ( — l) Si 4>i + sfix + 6i + Tiix. It was shown in [1] that this protocol is correct, i.e., if both the client and the server 
follow the steps of the protocol then the classical outcome are the results of some fixed single qubit measurements of the 
state U ( \ + ...+)) . These classical outcome corresponds to the signals generated by the measurements of the final layer 
of the brickwork state then bit flipped if the corresponding parameter was 1 and left as they are if the corresponding 
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FIG. 1: The brickwork state, <5„ X m, a universal resource state for measurement-based quantum computing requiring only single 
qubit measurement in the (X, Y) plane [1 . Qubits \ipx,y) (x = 1, . . . , n, y — 1, . . . , m) are arranged according to layer x and row y, 
corresponding to the vertices in the above graph, and are originally in the |+) = A= (|0) + |1}) state. Controlled- Z gates are then 
performed between qubits which are joined by an edge. The rule determining which qubits are joined by an edge is as follows: 1) 
Neighbouring qubits of the same row are joined; 2) For each column j = 3 mod 8 and each odd row i, the qubits at positions 
and (i + and also on positions + 2) and (i + 1, j + 2) are joined; 3) For each column j = 7 mod 8 and each even row i, 
the qubits at positions and (i + l,j) and also on positions + 2) and (i + 1, j + 2) are joined. 

Ti was zero. Moreover, the server will not learn anything about the client's computation, i.e., the protocol is blind with 
respect to the following definition: 

Definition 2. We say a protocol P on input X is blind while leaking at most L(X), where L(X) is any junction of the 
input if: 

1. The distribution of the classical information obtained by the server in P depends only on L(X). 

2. Given the distribution of classical information described m[7] and L(X), the state of the quantum system obtained 
by the server in P is fixed. 

Theorem 2. [1] Protocol [l] is blind while leaking at most the dimensions of the brickwork state, i.e. an upper bound 
on the input size and the depth of the computation. 

Equivalently, blindness implies that in Protocol [T] from the server's point of view, the distribution of the computa- 
tional angles, fa, is uniform and the final classical output is one-time padded [29], see [1] for the proof. Moreover, in the 
setting where the server's prior knowledge exists, the server does not acquire any new knowledge about the angles fa 
through the UBQC protocol. 

C Approximate blindness with prior knowledge 

In UBQC, the unitary transformation U that the client wishes to perform is encoded with a vector of angles <f> = 
(0i, . . . , fas)- I n general, it is reasonable to consider the scenario where the server may have prior information about the 
transformation U the client wishes to run. Since, in the framework of UBQC, the computation is encoded in the angles 
fa the server's prior knowledge can be modelled by assigning a non-uniform a priori probability distribution p(<j>). If the 
delegated computation protocol is blind, then the posterior distribution for the server should be equal to the prior one. 
This was established for the orig inal UBQC protocol [J. 

While the UBQC protocol is inherently adaptive, one can show that the Sj values do not contribute towards the 
blindness purposes and only effect the correctness of the protocol. Recall that after the initial qubits have been sent 
from the client to the server (i.e. having fixed the 'pre-rotation' angles 9i), the possible transcripts of the communication 
between the client and the server depend on two sequences of binary parameters: the declared measurement results Sj 
sent by the server, and the (random) choices of the parameters r\ chosen by the client. The classical information sent 
by the client is easily seen to depend on n + s, mod 2 (see step 3.5 of UBQC protocol). Since the parameters are 
chosen at random and unknown to the server, so are the values fj + s; mod 2. Hence every reporting strategy chosen by 
the server will result in responses from the client which are independent from the choice of the servers reporting strategy. 
So we may fix the reporting strategy (and the measurement outcomes) without the loss of generality. 

In what follows we define e-blindness for a UBQC with imperfect client preparation and prior knowledge. For the more 
special case where there is no prior knowledge, addressed in the main text, one need just set the probability distribution 
p(4>) to be uniform. Blindness can be studied through the following joint ideal blind state, with a priori probability 
distribution p(<p) and relative to the CPTP map £, defined as 



TT 



S,p(<j>) 
AB 




> crvcr 




which corresponds to the entirety of information, pertinent to the blindness of a UBQC protocol run, the client and the 
server share in the post-selected setting where all the signals are set to 0. This is, as we noted, done without the loss of 
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generality. Additional information the client and the server have access to would include the classical descriptions of the 
angles 9. However, these angles do not constitute the secret the client wishes to hide. The server may learn something 
about these angles, but what blindness requires is that this knowledge reveals nothing about the computational angles, 
or the hidden r parameters. The presented ideal state is suitable for addressing this question, by explicitly placing the 
client's secret in the client's register, and all information accessible to the server in the server's register. 

Here, the map £ is introduced because the server might deviate from the original protocol by applying such a map, 
as we have done in the setting with no prior knowledge in our paper. However, because he cannot get any information 
about the client's secret by performing such an operation, the final state remains as blind as in the absence of this map. 
Correspondingly, we define the family J 7 ^ $ ) of ideal blind states with respect to prior knowledge p( <p ) as follows: 



poG) = U^**) | £ is a CPTP mapj . 

Any protocol characterized by a state in J?p($) is as secure as the ideal UBQC protocol with prior knowledge p(4>). 
Again, like in the setting with no prior knowledge, the correctness of the protocol can be guaranteed only if the map £ is 
the identity. In general, the state describing a given protocol does not correspond to an ideal state, but is given by the 
following expression: 



K P Z iU ' P(t) = ~ £ Pit) & IhMl ® |riXr<|®P* ® MSi\ ■ (8) 



Client Server 



Definition 3. A UBQC protocol with imperfect client preparation and prior knowledge p{4>), in which the client sends 
states of the form p 0i instead of the perfect states \+e,) i n the preparation phase is called an e-blind UBQC protocol with 
imperfect states and prior knowledge p(4>), if the trace distance between the overall joint state given with the expression 
tei) and the family J- p ^ $ > of unconditionally blind joint states with prior knowledge is less than e: 



ndn \\\4B iM) -^s a) \\<e 



The above criterion is equivalent to 



mm — 

£ 2 1 



T AB 



£, P (4>) 

AB 



< e 



where the map £ ranges over all CPTP maps. 

This notion of approximate security makes a crucial use of the trace distance between the state obtained while running 
the actual protocol and an ideal state. This approach has been already used in the context of quantum cryptography 
and particularly for quantum key distribution, where the e-security of a protocol is defined analogously. The importance 
of the trace distance comes from the fact that it is closely linked to the maximal probability of distinguishing the actual 
protocol from the ideal one. Therefore, if this probability is arbitrary small, then the actual protocol is arbitrary secure. 

Next we compute how an approximate preparation of the states |+e 4 ) affects the blindness of the overall protocol. We 
wish to bound the distance 



mm 

£ 



AB 



v{4>) 



TT 



£,p(<P) 

AB 



where the minimization is over all possible CPTP maps £ acting on the system in the possession of the server. First, 
we can restrict ourselves to the maps £ which act individually and identically on the subsystems containing the qubits 



mm 

£ 



9 f«>*, p(^) e, P ($) 



'AB 



'AB 



< min 
e.i.i.d. 



P(0) 



AB 



£, P (<f>) 
AB 



This clearly holds as the minimization of the right-hand side of the expression above is just the minimization restricted 
to the subset of the minimization space of the left-hand side of the expression. One has 
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AB 



AB 



1 

2* 



< 



< 



h E p(?) 



2 s 



h e p(^) 



(g) |0iX0i||riXri|p fl< |TO|- (8) l&X&lhX'i|£(l+fcX+*l)ITO 
;e[S] ie[S] 



(^/'-(gmi+^x+d) 

ie[S] i£[S] 



(9) 



i£[S] 



Although the variables #i are drawn uniformly at random initially, their distribution, given Si and some prior knowledge 
about the angles <f>i is not uniform. While the expression ^ could be refined further, this general derivation becomes 
rather cumbersome, and is omitted here. Now we can characterize the quality of the qubit preparation by the parameter 



£prcp defined as: 



We then obtain: 



£prep = max- \\p - £{ 

9 z 



n AB AB 



< i E pC?)E <6[S ]||p fl4 -£(l+e«X+*il)| 

< ^s+i _E P( 4> )5 , e P rc P = 25e prep . 



Hence, in such a scenario, the obtained UBQC protocol is e-blind if: 

^^prcp — ^ • 

This proves the bound given in Eq. (6) in the main text. 
D Interlaced ID cluster computation 

The Interlaced ID cluster computation protocol, used as a subroutine in RBSP, is described in Protocol [2] 

Protocol 2 Interlaced 1-D Cluster computation (I1DC) 

• Input: A sequence of k states (|+ct,)); = i for at €r {^p}J_ . 

• Output: A binary string of measurement outcomes s = (si, . . . , Sk) and the state \+g), where 

1=1 

where the binary components ti are given as follows: 

Y^jZl s i m °d 2, for i < k 
for i = k 



(10) 



(11) 



(12) 



• Computation steps: 

1. For i = 1 to (k - 1) 

1.1 Apply the unitary ctrl-Z(ff <g> 1) to qubits i and i + 1. 

1.2 Measure qubit i in the Pauli-X basis, obtaining the outcome Si. 

2. Return the string s = (si, . . . , Sfc) and the remaining non-measured qubit in the state 



an honest server will follow the presented I1DC subroutine exactly. He will have sent the 
= (si , . . . , Sk) to the client who will then compute the angle 9 using the formulas 11 and 12 



In the RBSP protocol, 
measurement outcomes s 

For the correctness of the encompassing RBSP protocol, we need to show that the angle the client computes is the same 
as the angle parametrizing the state kept by the server. This constitutes the correctness of the I1DC protocol, and we 
give it with the following lemma: 
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Lemma 4. Protocol [H is correct. 

Proof. We will prove by induction that the state of the output qubit in the interlaced 1-D computation protocol performed 
on the input of k qubits in the states {|+o-i)}f =1 , given the sequence of measurement outcomes (si, . . . , Sk-i) is the state 
\+e), where 

k 

= 5>l)*a, (13) 

i=i 

where the binary parameters (t\, . . . , tk) are computed as follows: 

t = { HjZl Si mod 2, for % < k, , 
1 \ for i = k. V ' 

For the basis of the induction we verify that the claim holds for the first non-trivial case, k = 2. Consider the state 

Ctrl - Z(i?Cg)l)|+ ffl )<g)|+ CT2 ) 

It is easy to check that the state of the second subsystem, after the measurement of the Pauli-X observable on the first 
subsystem of the state is the state |+ (T2+ (_i)si (Tl ), where s% — corresponds to the measurement outcome associated 
to the post- measurement state |+) and s± = 1 to the outcome associated to the post-measurement state |— ). Then, 
according to Equation (12), t\ = s% and t% = 0, and then Equation (111 gives 

9 = (-l)* 1 ^ + (-l) t2 a 2 = (-l) 51 ^ + a 2 , 

which is the angle corresponding to the resulting state for the case k — 2. 

Assume then the step of the induction, i.e. that the claim holds for the input size k — n, and let us then show that it 
then also holds for k = n + 1. Consider the case where the computational steps of the I1DC protocol have been run to 
the n th step, i.e. to finish off the protocol, the output qubit of the first n steps of the computation needs to be entangled 
to the (n + l) s * qubit using the prescribed interaction and measured in the Pauli X eigcnbasis. Let (s%, . . . , s n _i) be the 
measurement outcomes of the first n — 1 measurements. Then by the step of the induction the state of the output qubit 
of the first n steps is |+e') where 



i=i 

and 

+> _ / YT 3 =i s i mod 2 = for * < n > 

1 \ for i = n. 

If the entangling interaction is then applied on this resulting qubit \+e') an d the remaining qubit |+<t„ +1 ), and the first 
qubit is then measured in the Pauli X eigenbasis, by the basis of the induction, the resulting state is \+g) where: 



This in turn can be expanded as 



for 



(-l) s "9' + a n+1 . 



= (-l) s "9' + a n+1 

n 

1=1 

n 

i=i 

n 

El l\(y% ■ Si mod 2) 

i=i 
n+l 

= £(-i) t! ^ 
i=i 



Y^j=l s i m od 2, for i < n + 1, 
for i = n + l. 



Hence, the I1DC protocol is correct. □ 
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Protocol 3 Remote Blind qubit State Preparation with weak coherent pulses with parameters (TV, T) 

1. Client's preparation 

1.1 The client generates TV weak coherent pulses with mean photon number fi — T and a randomized phase and a polarisation 
cy i (for 1 = 1,..., TV). These states are described by 

k=0 

The polarisation angles oi are chosen uniformly at random in {kn/4 : < k < 7}. The client stores the sequence 

((71, . . . , CTjv). 

1.2 The client sends the states {p a '}i to the server. 

2. Server's preparation 

2.1 For each state he receives, the server performs a non-demolition measurement of the photon number, obtaining a 
sequence of TV classical values and TV post-measurement states. If the measured photon number was greater than zero, 
the server keeps one photon, discarding the rest. 

2.2 The server reports the string (ni, . . . , njv) to the client. 

3. Client-server interaction 

3.1 The client verifies that the reported number of vacuum states is not too large with respect to the tolerated value of 
the transmittance T of the quantum channel between the client and the server. More precisely, if this number is larger 
than N(e~ T + T 2 /6), then the client aborts the protocol. 

Otherwise the protocol continues. 

3.2 The server discards the systems for which he measured zero photon. Each subsystem with n; > photons measured, 
parametrized by the polarisation a, is interpreted as a system of ni qubits in the state |+ CTi } . Only one qubit copy per 
received state is kept, and the total remaining number of qubits is M. 

3.3 Using the qubits from the step above and respecting the sending order, the server performs the I1DC computation (see 
Protocol [2J , obtaining the sequence t = (ti, . . . ,£ju) and keeping the resulting state |+e). 

3.4 The server reports the string t to the client. 

3.5 Using her knowledge about the angles <t; of the qubits used in the I1DC procedure by the server, and the received 



outcome string t, the client computes 9 with formula (111 



E Remote Blind qubit State Preparation 

The Remote Blind qubit State Preparation protocol (RBSP) is described by Protocol [3j In order to prover the 
security characteristics of RBSP, we prove the following properties which together with the properties of the original 
UBQC protocol in pQ prove the claims in the main text: 

(A) Upon the completion of the RBSP protocol the state in the server's possession is £ (\+e)(+e\) for some CPTP map 
£ (independent of 9) and the client alone knows the angle 9, except with probability Pf a ii; 

(B) The protocol is never aborted in the honest server scenario, except with probability p a bort; 

(C) In the honest server scenario, the map £ is the identity if the client did not abort and the protocol is correct. 

The correctness of the protocol in property (C) above means that upon the successful completion of the RBSP protocol, 
the server has the state |+e)(+e| where 9 is the angle the client has computed. 

We claim that he probabilities pf&u and p a t>ort are bounded above in terms of the protocol parameter TV, and relative 
to the transmittance lower bound T as follows: 



Pfail, Pabort < exp 




Proof. We begin by proving Claim (C), which is a consequence of the correctness of the interlaced 1-D computation 
protocol, Lemma [4] For Claim (C) to hold, first it needs to be shown that, if the protocol was not aborted, and the 
server is honest, then the server's system is in the state \+$) for some 9 known only to the client. In the case where the 
server is honest, prior to the call to the interlaced ID cluster computation subroutine, the server's system is in the state 




1 = 1 



where the angles o~k are known to the client. Then the server will perform the interlaced ID cluster computation using 
this system as the input, reporting the bit string (tx , . . . , t^), which is related to the measurement outcomes, as explained 
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in Protocol [2j The client will then compute the angle 6 using the formula (11). Hence, by Lemma [4] this angle is 
precisely the angle defining the state \+g) in the server's subsystem. What remains to be seen is that the angle of this 

fc fc-1 

resulting state is chosen uniformly at random. Recall that the angle 9 is given with 9 — {~^) tl<J i = (~^) tl °~i + ^k, 

i=i i=i 

and since the angles <7fc are polarisation angles and they are assumed to be chosen uniformly at random, the angle 9 is 
also distributed uniformly at random. This proves that the client alone knows the value of 9. 

To prove Claim (B), we will need to bound the abort probability when the server is honest. Finally, for Claim (A), 
we will need to show that if the protocol is not aborted then the state in the server's possession is £ i\+e){+e\) for some 
CPTP map £ , where 9 is the angle the client will compute based on the servers feedback, except with probability pf a u. 

We address these two required properties throughout the rest of this section. In Lemma [5) which we present later, we 
show that if during the run-time of the protocol the server measures a single photon in one of the states (coherent pulses) 
sent by the client and declares it as such, then if the client does not abort the protocol, the resulting state with the server 
is £ (\+e)(+e\) for a CPTP map £, where 9 is the angle the client will compute based on the servers feedback. Hence, the 
probability of this not happening, is the failure probability, pf a u. 

k 

Here, we note pk = e ~ M |r the probability of receiving k photons if the channel is perfect (unit transmittance), and 

p\ = e ^^r - the probability of receiving k photons if the quantum channel between the client and the server is a 
lossy channel of transmittance T. In fact, since the events with 2 or more photons are not distinguished by our protocol, 
we note p>2 (resp. p> 2 ) the probability of obtaining 2 or more photons for a perfect channel (resp. a channel with 
transmittance T). 

In what follows, we derive the bounds for both pf a u (blindness) and p a bort (robustness). For each state that the server 
receives, he is supposed to perform a non demolition measurement of the photon number and to announce this number 
to the client. Here, we are only interested in three types of events: 

• "event 0" when the server measures photon. This event has probability pfi in the case of an honest server since 
the transmission channel is characterized by a transmittance T. 

• "event 1" , when the server measures exactly 1 photon. The whole point of the protocol is to make sure that at least 
once, this event occurs and the server has to announce that he received one photon. If this is the case, by Lemma 
[5]we are guaranteed the server has the desired state £ (|+e)(+e|) for a CPTP map £ . 

• "event 2" , when the server measures at least 2 photons. In the case of a malicious server, one has to suppose that 
the probability of such an event is p> 2 (instead of p> 2 ), meaning that we assume that the server has the ability to 
replace the imperfect quantum channel by a lossless one. 

As we will explain below, without loss of generality we may assume that the server always performs the number 
measurement. Then, if the server is malicious, his only strategy consists in declaring he received photon when he 
detected 0, declaring he received photon when he detected 1, and declaring either 1 or more when he detected at least 2 
photons. Any other strategy will either mean that the server will admit to having measured one photon in which case, by 
Lemma [5] the protocol will end in a satisfactory state. Alternatively, the server has to report that he measured 1 photon 
when he in fact measured none. In this case in the setting where the client did not abort, the angle the client computes 
will be uncorrelated to the state generated by the server. However, this corresponds to a state of the form £ (\+e)(+o\) 
for a CPTP map £ where the map £ is the contraction to the state in the server's possession, independent of the client's 
calculated angle 9. We will prove this formally in Lemma [6] presented later. 

Let us denote with N the total number of states sent by the client, Mo, Mi and M2 the number of states for which 
the server measured respectively 0, 1 or at least 2 photons. Also define No,N\ and A 2 to be the respective numbers of 
states for which the server reported having measured 0, 1 or at least 2 photons. Note that the numbers Mo, Mi and M2 
are well-defined since the server does not gain anything by not measuring the photon number for each state he receives. 
This is because the measurement operators commute with the state sent by the client, which are diagonal in the Fock 
basis. We can therefore assume that he performs this non-demolition measurement. 

These various quantities are related through the normalization constraint 

M + Mi + M 2 =N a + N 1 + N 2 = N. 

For an honest server, one has Nq = Mq, Ni = M%, N2 = M 2 . A malicious server will however choose a strategy such that 
No = Mq + Mi. Consider the probability that the protocol aborts when the server is honest. Hoeffding's bound [? ] 
immediately gives an upper bound for p a bort , for any A > we have 



Pabort 



M T 

Po > A 



N 

< exp(-2A 2 A0 



(16) 



The only way the protocol fails is that the malicious server applies the strategy described above, (that is, to pretend 
he did not receive anything unless he actually received at least two photons) while not being detected. Let us consider a 
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tolerance A which will be optimized later. One has: 



Pfaii = Pr 

< Pr 

< Pr 

< Pr 



Po < A 



No _ r r 
N 



M Q + Mi T 



M 2 T 



M, 



N 

< exp(-2A 2 iV), 



- P2 > 1 - Po - P>2 - A 



(17) 



with 



A:=l-j% -p>2- A. 

In order to get a non-trivial bound for pf a u, the parameter A should be positive and bounded away from 0. One has 

A + A = 1 - e - T " - (1 - (1 + A*)e-") 
= e -"(l + /i-e< 1 - 7 >) . 

If we fix p = T, we obtain 



A + A = e~ T (l + T - e T(1 ~ T) ) > 



T 2 



Hence, choosing A = A > T 2 /6, one gets 



□ 



Pfail, Pabort < exp 



NT 4 



While the probabilities pf a u and p a bort can in principle be made arbitrary small for any (positive) value of the transmit- 
tance, one notes that the required number of weak coherent pulses scales like log(l/e)/T 4 for small T, making the scheme 
less efficient. In general, this subroutine will be used S times during the complete UBQC protocol. The probabilities that 
blindness or robustness is jeopardized during this whole process can be bounded easily with the union bound and they 
are simply increased by a factor S. This means that the correct scaling for the parameter N should be (log(S'/e))/T 4 . 

In the above, we considered one specific implementation of the remote blind qubit state preparation protocol using 
weak coherent pulses. This choice was made because weak coherent pulses are arguably the simplest quantum states to 
prepare in a laboratory. However, the protocol could be easily generalised to any source of light that emits a mixture of 
Fock states. In particular, the protocol would work equally well with a thermal source of light. The only characteristics 
which are required are that the probability of emitting exactly one photon is strictly positive, and that the client is able 
to calibrate her source well enough. In other words, reasonable bounds on the probability of emitting a given number of 
photons should be available. 

Next, we present the lemmas we need to complete the proof above. 

Lemma 5. If the server measured a weak coherent pulse sent by the client to contain one photon, declared it as such 
honestly to the client, and the client did not abort in the presented remote blind qubit state preparation protocol, then the 
state in the possession of the server after the termination of the protocol is £(\+e)(+e\) f or a CPTP map £ where 9 is the 
angle computed by the client. 

Proof. We begin the proof by describing the system of the client and the server after the server has reported the binary 
string {ti]i to the client, which he has to do to prevent the client from aborting. The client has the following: 

• A sequence of angles {f/c}^^ which the client has encoded in the polarization of the initially sent coherent pulses, 
corresponding to those pulses for which the server has announced a non-zero declared photon number. In this 
sequence the angles come in multiples, with individual indexes, the multiplicity corresponding to the announced 
number of photons declared. The total number of photons declared is then M. 



A sequence of binary digits {tk}k reported by the server, where the last digit tu is zero. 
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By assumption, the server measures at least one pulse for which he gets one photon and declares one photon. Without 
loss of generality, let us assume that this is the case for the final pulse characterized by its polarization angle om ■ The 
client will then calculate the value 8 = Xa=i 1 °i + a M- 

On the server's side, prior to declaring the binary digit outcomes, the server's quantum state can in all generality be 
written as: 

ri ai '-''™- 1 ®\+ < r M ){+a M \, 

where the state |+ CTJU ) is the state of the single copy declared qubit. The rest of the server's system depends on the 
number measurement outcomes, but can always be written in the generic form rf l ''"' (JM ~' L . In the case the server was 
honest, his system will be exactly of the form: 

X + CT1 I®---® I) ® \+*m)( + *M I , 

where the states before the final state may come in multiplicities which match the declared number measurement outcomes. 

Note that, whatever procedure the server may run on the system in his possession, in the spirit of the Stinespring 
dilation theorem, f can always be represented as a unitary transform U on the input system, augmented by an ancillary 
system, followed by a measurement on the output of the overall unitary transform. The classical outcome will, in general, 
encode the binary digits {tk}k the server has to report to the client, as in the case of no report the protocol is aborted. 
We emphasize that we are not assuming anything about the classical outcome - it may be a result which depends on the 
states the server recieved from the client, it may be chosen randomly by the server, or it may be selected. The state in 
the server's possession prior to measurement, p pllm ' , can then be viewed as the result of a CPTP map (which depends on 
the state fi" 1 '—'"**- 1 ) applied on the state |+<t m )(+<t m | 

This is only possible because the angle um does not depend on any other angles. For simplicity, we shall fix the angles 
or, . . . , crjf-i and simply write the state prior to measurement: 

p^ = £(\+ aM )(+ aM \). 

Since the angle a^j was chosen uniformly at random, known to the client, the state of the server's system is: 

7Wer = l/8££(l+a„X+a M |)- 
cm 

Following this, the server will measure a part of his subsystem, obtaining the sequence of binary digits t = {tk}k 
which he reports to the client. The state of the system after measurement (taking into account all possible outcomes) 
can be written as: 

TTscrvcr = 1/8 £ £ V<T U ( * (I +c M ){+c M I)) 

CM -f 

where Pa M ( t ) is the probability of outcome t given that the input state was cxm, and £-> are the quantum operations 
which depend on the outcome. Note that: 

5> CTM (t)£ t =£ (18) 
t 

for all angles <jm ■ As the two sums commute, we can write this state as: 

Server = 1/8^£> CTm (t )£ f (| + CTM )(+ ffM |). (19) 

Recall that a fixed sequence t along with the fixed sequence of angles ctj., . . . , <jm—x defines the angle 9: 

Note that the value of 9 attains all possible angles when um goes through all possible angles, for t and a%, . . . , <Jm-\ 
fixed. Now, since the sum: 



£p CTM (t)£ t (|+ ffM )(+ CTM |), 

cm 

for a fixed sequence t goes through all the possible angles, this sum is, for every sequence t , equal to: 

Server = l/^EE Pe(?)£^(\+e)(+e\) ■ 



Due to property (18), this final state is of the form £(\+g)(+g\). □ 
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Lemma 6. If the server measured a weak coherent pulse sent by the client to contain zero photon, and declared it as 
containing one photon to the client, and the client did not abort in the presented remote blind qubit state preparation 
protocol, then the state shared by the client and the server after the termination of the protocol is of the form £ 
for some CPTP map £ . 

Proof. We will extensively use the setup and the arguments of the proof of Lemma [HJ Assume that it is the ^ th declared 
photon that the server does not possess. Then for the sequence of binary digits (t\ . . . ,tk) the server will have reported 
as the alleged classical outcome of the interlaced ID cluster computation, the angle the client computes is given as: 

k 

# = ]T(-i)^, 

which can be written as: 

e= J2 (-ly^i + i-iY'vi. 

ie{i,...,i-i,i+i,...fe} 

Let us fix all the <Ji angles except c; and all the reported binary digits t{ except t\. The general state with the server 
after the remote blind state preparation protocol can then be written as: 

1 1 

Server = ^ K*0 X! g^' 
t(=0 <J l 

where r/ is the state in the hands of the server, which may depend on £/, and p(ti) is the probability of the server reporting 
ti to be one or zero. Note that neither the probability p{ti) nor the final state rf l can depend on 07. The angle 9 in the 
expression above for any fixed ti goes across all possible values as 07 ranges across all possible values. Hence the sum may 
be written in terms of the angle 9 rather than o~i as: 

1 x 

TTscrvcr = ^ X] g^' ' 

ti=0 9 

Also, since rf l does not depend on 07 it does not depend on 9 so we can factor it out of the sum 

Server = 5>(<j) \) = X ' 

tj=o \ e / t t =o 

1 

Let T\ be the quantum state ^ P(ti)v tl > then we have 

ti=0 

^"server '/ 

which implies 

Server = £ "(|+eX+fl|) 

where £ v is a CPTP map which is the contraction to the fixed state 77. □ 
F Characterization of the states generated by RBSP 

As we discussed before, the only source of imperfection in the implementation of the UBQC protocol comes from 
the fact that the client cannot generate exactly the states but only an approximate state p e . Using the remote 

blind qubit state preparation protocol with parameters (A, T), the state generated instead of \+g) can be described, in a 
worst-case scenario from the client's point of view, as 

P 6 = (1 -Pi^)£ S (\+e){+e\) ® |0)(0| +p fai i|0><0| ® |1)<1|, (20) 

where Pf a n < exp {— and \9) is a classical state giving full information about 9 30J. This state corresponds to the 

worst case scenario because we assume that if the server manages to avoid "event 1" (measuring a single photon in a 
weak coherent pulse and declaring it as such), corresponding to the indicator register with the state |1)(1|, which happens 
with probability pf a n at most, then the server obtains complete information about the angle 9 chosen by the client. As 
we have shown, in any other cases the server has the state £ S (\+e)(+e\) for some CPTP map £ s , relative to the angle 9 
computed by the client. In modelling this, we considered an additional quantum register with values |0) or |1), available 
to the server, which tells whether the remote blind qubit state preparation succeeded or not, as it can be seen in Equation 
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(20). This is a classical-quantum state, and the classical register containing either |0) or |1) represents the information 
whether the server managed or failed to cheat and the server clearly has access to this information. 
We have that 

l\\ P e -£(\+e)(+e\)\\ <pm 

for every 9 and the CPTP map £{p) := £ s (p) <S> |0)(0|. This map simply applies the CPTP map £ s to the input state 
and appends the state |0). Hence, in order to characterize blindness, one just needs to consider the condition described 



in Equation (10 1, that is Se sta ±es < £ and to note that 

NT 4 



Pfaii < Sexp j 

The latter claim holds as we have taken into account that the remote blind qubit state preparation protocol is used S 
times during the complete UBQC protocol and the probabilities that blindness or robustness is jeopardized during this 
whole process can be bounded easily with the union bound as they are simply increased by a factor S. Hence, choosing 
N = 181n(S , /e)/T 4 allows the client to obtain e-blindness for the overall UBQC protocol for arbitrary small values of e. 
The above explanation, given the proven bounds on the probabilities pf a n and p a borti proves the main theorem of our 
paper. 
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the state seen by the adversary is a totally mized state, 

n 1 

E {<® =1 z?x?)p{®v =1 x?z?). 

i — l ,yi — 
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for6> = kir/4 and the qubit state \+ e ) as \+ e ) := l/v2(|0) + 
exp(ifc7r/4)|l}) 



